If the law requires, or a contract permits, the laboratory to disclose confidential information, the patient shall be told what has been disclosed, except where the law forbids telling them. Information about a patient that comes from someone other than the patient (for example a complainant or a regulator), and who that source is, shall stay confidential and not be passed to the patient without the source's agreement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.